16 ms·

10 Years of Let's Encrypt

817 points by SGran 10mo ago

victorbjorklund 10mo ago
Wow. Feels like Let’s encrypt been around for longer.
- Aardwolf 10mo ago
  Agreed! What were we using before Let's Encrypt again? Maybe just plain HTTP
  - bakies 10mo ago
    Self signed certs. I wasn't paying.
    - Thaxll 10mo ago
      Some of them were not expensive but it was not convenient at all.
  - rew0rk 10mo ago
    either you used http, self signed if you did not mind the warning, and i remember there being one company that did offer free certificates that validated, but cant remember the name of it
    - tomklein 10mo ago
      I believe it was StartSSL and/or WoSign back then
    - SahAssar 10mo ago
      > i remember there being one company that did offer free certificates that validated, but cant remember the name of it You're probably thinking of StartSSL, and it was a bit of a pain to get it done.
  - deleted 10mo ago
    [deleted]
  - asadotzler 10mo ago
    SSL/TLS via expensive and hard to work with providers and tooling. Let's Encrypt made it free and easy to maintain.
  - ZeroConcerns 10mo ago
    Mostly Verisign, which required faxing forms and eye-watering amounts of money. Then Thawte, which brought down prices to a more manageable US$500 per host or so. Which might seem excessive, but was really peanuts compared to the price of the 'SSL accelerator' SBus card that you also needed to serve more than, like, 2 concurrent HTTPS connections. And you try telling young people that ACME is a walk in the park, and they won't believe you...
    - anamexis 10mo ago
      And then sketchy resellers for Verisign/Thawte, which were cheap but invariably had websites that ironically did not inspire confidence in typing in your credit card number.
    - dylan604 10mo ago
      As GP posited, because of this headache, lots of web traffic was plain ol' HTTP. Let's Encrypt is owed a lot of credit for drastically reducing plain ol' HTTP.
  - SirMaster 10mo ago
    I was using StartCom StartSSL which was offering free 1 year certificates at least for my personal sites.
    - 0x0 10mo ago
      They were great in the beginning, and then when you issued a few more certs than they liked you were asked to pony up some $$$, and then when you did that and actually "verified" who you were on a personal international phone call, you got a grace, and then issued a few more, they decided they didn't like you so they would randomly reject your renewals close to the expiration date, and then they got bought out by some scummy foreign outfit which apparently caused the entire CA to be de-listed as untrustworthy in all major browsers. Quite the ride. Also, the only website I've ever encountered that actually used the HTML <keygen> tag.
  - 1f60c 10mo ago
    The pros were using client-side encryption :D
- quesera 10mo ago
  I was going to say the opposite. LE still feels like the "new" way, to me. :)
jjice 10mo ago
Let's Encrypt was _huge_ in making it's absurd to not have TLS and now we (I, at least) take it for granted because it's just the baseline for any website I build. Incredible, free service that helped make the web a more secure place. What a wonderful service - thank you to the entire team. The CEO at my last company (2022) refused to use Let's Encrypt because "it looked cheap to customers". That is absurd to me because 1), it's (and was at the time) the largest certificate authority in the world, and 2) I've never seen someone care about who issued your cert on a sales call. It coming from GoDaddy is not a selling point... So my question: has anyone actually commented to you in a negative way about using Let's Encrypt? I couldn't imagine, but curious on others' experiences.
- rokkamokka 10mo ago
  No! Let's encrypt is easily the best thing that's happened for a secure internet the last 10 years.
  - DaSHacka 10mo ago
    And equally as much for a centralized internet...
- johnebgd 10mo ago
  There are extended certificates that did matter in our sales process for some hosted solutions back about 15 years ago if I recall right… no one has ever cared since…
- giancarlostoro 10mo ago
  > It coming from GoDaddy is not a selling point... I just people who use GoDaddy. They were the one company supporting SOPA when the entire rest of the internet was opposed to SOPA. It's very obvious GoDaddy is run by "business-bros" and not hackers or tech bros.
  - dylan604 10mo ago
    This is my feeling as well. Finding out someone uses GoDaddy is a bit of a shibboleth.
npodbielski 10mo ago
I am glad to be one of the users using that for around 7 years. I can't think of how much better is life of people just doing blogs or some silly websites with free https certs. Would I pay 50$ bucks a year for ability to self host nextcloud? Probably not. But security enhancement is so enormous with that service. Thanks to everyone involved for making world a little bit better.
greyface- 10mo ago
New baseline expectation that web traffic will be encrypted on the wire: very good! New de-facto requirement that you need to receive the blessing of a CA to make use of basic web platform features... not so good.
- jovial_cavalier 10mo ago
  That's not new, LetsEncrypt just didn't solve it. And if you think this is the only single point of failure in the stack, I have news for you.
  - greyface- 10mo ago
    It's absolutely new. No HTML5 features were restricted to secure origins only pre-LE. Today, many are. Google was able to push these requirements in large part due to Let's Encrypt's success making secure origins ubiquitous.
    - ekr____ 10mo ago
      The order of events is a bit more complicated than this. Google initially proposed restricting powerful features to secure origins back in February of 2015 (https://web.archive.org/web/20150125103531/https://www.chromium.org/Home/chromium-security/prefer-secure-origins-for-powerful-new-features/ https://web.archive.org/web/20150125103531/https://www.chrom...) and Mozilla proposed requiring secure origins for all new features in April of 2015 (https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-http/ https://blog.mozilla.org/security/2015/04/30/deprecating-non...). Let's Encrypt issued its first certificate in September of 2015. This isn't to say that these two things are unrelated: Mozilla obviously knew about Let's Encrypt and we considered it an important complement for this kind of policy, and at least some people at Chrome knew about LE, though I'm not sure how it played into their thinking. However, it's not as simple as "LE happened and then people started pushing for secure origins for new features".
      - bruce511 10mo ago
hulitu 10mo ago
> 10 Years of Let's Encrypt Aren't they only 45 days [1] old ? [1] https://letsencrypt.org/2025/12/02/from-90-to-45 https://letsencrypt.org/2025/12/02/from-90-to-45
- p2detar 10mo ago
  Not sure if you're joking or not, but I have to deal with this upcoming change at some point and still haven't read in detail why they decided to do this. Could anyone clarify?
  - chippiewill 10mo ago
    Lets Encrypt are doing is because of the decision that CAs and browser makers made that it needs to be reduced (browsers have been reducing the length of certs that they trust). The why is because it's safer: it reduces the validity period of private keys that could be used in a MITM attack if they're leaked. It also encourages automation of cert renewal which is also more secure. It also makes responding to incidents at certificate authorities more practical.
    - dingaling 10mo ago
      > it reduces the validity period of private keys that could be used in a MITM attack if they're leaked If a private key is leaked, 45 days is sufficient to clean-out the accounts of all that company's customers. It might as well be 10 years. If cert compromise is really common enough to require a response then the cert lifetime should be measured in minutes.
  - bifurcation 10mo ago
    Hi there, ISRG co-founder and current board member here. In brief, shorter lifetimes force people to automate (which, e.g., avoids outages from manual processes) and mitigates the broken state of revocation in the Web PKI. That latter point especially is what I understand to be driving the Web PKI toward ever-shorter lifetimes. I actually remember the discussion we had in ~2014 about what the default certificate lifetime should be. My opening bid was two weeks -- roughly the lifetime of an OCSP response. The choice to issue certificates with 90 day lifetimes was still quite aggressive in 2015, but it was a compromise with an even more aggressive position.
Decoy1008 10mo ago
I am so grateful for this. Bummer that they stopped with the email reminder, anyways I was wondering how this would work without active payments. Still amazing.
- callumgare 10mo ago
  Out of interest why do you care? I assume you’re using acme to automate renewals. Is it in case that fails? Or do you work with some system that can’t be automated?
  - tempaccountabcd 10mo ago
    [dead]
  - eeixlk 10mo ago
    Literally just got bit by this. I added a wildcard domain to a cert servicing multiple sites. Apparently the verification process for wildcards is more onerous and even when you have it working it wont renew in the same way as a normal cert. It requires specific workarounds based on your dns provider. Appreciative that we moved away from paid certs that required manual work to renew every year but this feels like a mismanaged backslide.
sam_lowry_ 10mo ago
[flagged]
- jsheard 10mo ago
  It's not like Let's Encrypt is the only game in town, Actalis in Italy provides free ACME certs too if you'd prefer to keep things in Europe.
  - charlesbarbier 10mo ago
    Not sure if there is a point to "keep things in Europe" when it come to certificate authority. - LetsEncrypt don't have the private key tied to your certificate - Any of the Certificate Authorities could potentially emit unauthorized certificate Your only protection for all of these problems is HPKP. If you prefer to keep things in Europe, keep that pinned private key in Europe, but the rest doesn't matter. That said, it's pretty nice that LetsEncrypt forced the ACME protocol on this industry. Not only it create redundancy with mostly interchangeable alternatives but before ACME, there was no way to fully automate certificate provisioning cleanly.
    - bifurcation 10mo ago
      Just to clear up one point -- Let's Encrypt did not at all force ACME on the industry. We deliberately took it to the IETF so that we could get input from more parts of the industry (including some major refactors!). Instead of pressure from Let's Encrypt, I would attribute its success to the open process of the IETF, the awesome open-source community that made great ACME software (shoutout to Matt and Caddy!), and the resulting pressure on CAs for a better user experience from users and customers.
      - charlesbarbier 10mo ago
        I didn't express myself well but what I meant by force is that by building a standardized to automate way manage certificate, ACME imposed itself and became mandatory. Previously, most CA had no programmatic way to order certificate, it was all done manually. As far as I know, the only providers with that would let you automate certificate provisioning at the time where Comodo, GlobalSign and Digicert. They all had their own quirky API. Just to give you an idea, we ended up selecting GlobalSign at Shopify a few years before LetsEncrypt, and it was this SOAP nightmare: https://www.globalsign.com/en/repository/GlobalSign_Client_API_User_Guide.pdf https://www.globalsign.com/en/repository/GlobalSign_Client_A... At first none of them were warm at the idea of providing an ACME endpoint. I'm assuming part of it is the cost of implementing it but they probably liked the stickiness of their custom APIs too tied to million dollars contracts. Nowadays they all implement ACME. At some point, they where effectively forced to implement it to acquire new customers and keep their existing base around because nobody would accept poorly designed custom made protocol anymore.
asim 10mo ago
As a sysadmin in the 2007-2011 timeframe I literally used openssl to generate csrs, went to godaddy to purchase SSL certificates and then manually deployed them to servers. Man what a world of change. Let's encrypt is one the best services we've had on the internet. I wish we had more things like this.
- par 10mo ago
  i was doing this until a couple years back when a friend told me about LetsEncrypt! It's like magic!!
- amatecha 10mo ago
  Ah man, I remember those days. So tedious!
- noAnswer 10mo ago
  Would be cool to have it for S/MIME too.
- Ayesh 10mo ago
  It's been a long time so this is my fading memory, but CAs used to generate a private key on their end and let you download both private key and the certificate containing the public key. The non-technical person who paid big money for the certificate then emails the zip file to the developer. That's when StartTLS wasn't that big back then either. Just comically bad way to obtain certs.
  - j16sdiz 10mo ago
    Many CA have in browser javascript-based private key generation. (Of course the same page have GoogleAnalytics and facebook button -- otherwise it would be too secure.)
- merpkz 10mo ago
  As a sysadmin in 2020 - 2024 time frame I used to do that all the time at my previous job, got a strong openlssl cli game going whenever needed to generate a new csr for existing key or new key and shovel an exact amount of SANs into the CSR too. Lot of time wasted. There were also a certain set of customers for which we managed systems and they insisted for it to be done this way as something free on the internet is not to be trusted. Oh well, strange times.
scblock 10mo ago
LE has been really great, particularly in running hobby web sites on the public internet. Getting certbot up and running wasn't hard, automating renewal wasn't hard, and because they have DNS-based pathways to verification you can use LE certificates for sites not exposed to the public internet as well. Combine it with something like Caddy and getting SSL for an app becomes the default without ever having to manage certificates by hand. I find it pretty amazing how far its come, and how big a change it has made to the internet in the decade it's been operating.
jrochkind1 10mo ago
it is hard to believe it's been ten years.
tracker1 10mo ago
I'm not sure that I'm more surprised that it's only been 10 years or that it's been that long. I mean, that's a relatively quick turn around to pretty much dominate TLS certs to the point that it's the default for so many platforms... that HTTPS has become such a norm over the exception. On the other hand, has it really been that long, it seems just yesterday I was first trying to configure nginx for it. That said, since I discovered Caddy, I haven't really looked back, though I do use Traefik too. I mean, by comparison, it feels like IE6 took longer to die than Let's Encrypt has been around.
awaseem 10mo ago
Incredibly grateful for this project
ok123456 10mo ago
Snowden was the other big reason that TLS became the de facto standard for every site. Prior to that, the consensus was that you only really needed TLS if you were dealing with money and wasn't worth the hassle otherwise. You could sniff traffic from Facebook and Twitter easily. I remember listening to a talk given by an IRS investigator in around 2008 about how they were able to do a sting and shutdown illegal internet casinos. They collected a good bulk of that evidence from clear-text packet captures of gambling sessions and messages. He preemptively answered the question of whether encryption was a hurdle, by saying no one used it.
- tptacek 10mo ago
  This is a retcon. Facebook rolled out TLS in 2011, 2 years before Snowden, and went TLS-by-default within a month of the Snowden disclosures. Google Mail was TLS-by-default in 2010. TLS was a universal best practice long before 2013 --- by 2010, you'd have gotten a sev:hi vulnerability flagged on your site if you hadn't implemented TLS. SSLLabs was 2009; BEAST was 2011, and was a huge global news story because of how widely deployed TLS was.
  - ok123456 10mo ago
    Yes. And I remember sniffing Facebook traffic in clear text in 2011. The fact remains that it was considered a significant engineering problem for them to deploy it. It was a "best practice" that most people rolled their eyes at. Most users and system owners didn't care unless money was being transacted. Between Snowden and ISPs injecting content into pages, the consensus changed.
    - tptacek 10mo ago
      The consensus obviously changed. It's just that it changed years before the Snowden leaks.
      - ok123456 10mo ago
        The adversarial nature of the US Government changed the threat model, and it moved from a "nice to have" best practice to a business necessity. They were caught red-handed undermining the privacy of US citizens by systematically exploiting infrastructure vulnerabilities, for example, in Google, where messages flowed in clear text within nominally trusted contexts.
stego-tech 10mo ago
Let’s Encrypt is something so amazingly valuable that I was certain it’d be killed dead within a year to prop up the existing SSL cert business. Congrats on a decade, ya’ll, here’s to many, many more in securing the free internet.
Havoc 10mo ago
Reminder that it’s a non profit
vadepaysa 10mo ago
LetsEncrypt is on my end of year Donate list for the past 5 years. With all modern browsers requiring HTTPS everywhere, a world without Let's Encrypt would be really difficult for indie developers. Thank You for an amazing product!
kyawzazaw 10mo ago
my friends work here! and it was founded by an alum from my school Macalester College
postbase 10mo ago
thank you for your service
t1234s 10mo ago
Lets hope they stay independent and never get acquired by Google or any other large tech company. You can imagine a web where SSL issuance is used as a tool to censor websites. I think most browsers have been made to make standard http sites look malicious to normal users.
- mikeyouse 10mo ago
  They're a nonprofit - so they can't be acquired like a typical for-profit company. They could in theory sell some assets but it'd be very convoluted if they were the core assets -- per US tax law, nonprofit assets must remain in the nonprofit world, so there's no risk of any tech company ruining them.
  - xandrius 10mo ago
    I heard similar things about another American nonprofit and now I'm not so sure about it. When money and will comes along, loopholes come as well. So, I wouldn't be so sure, unfortunately.
  - johncolanduoni 10mo ago
    Look at OpenAI - where there’s a will (and an army of lawyers), there’s a way. That said, I don’t think any of the big tech orgs would be interested in acquiring them. Google and Amazon even already have their own public CAs that are in the major trust stores.
- deleted 10mo ago
  [deleted]
- crapple8430 10mo ago
  If Google wants to censor your website, they have a variety of other, more effective methods, like by adding it to their safe browsing blacklist, which is also used in many Firefox installs.
  - morshu9001 10mo ago
    Or even more apples to apples, they could ignore your cert in Chrome
hbn 10mo ago
Yes let's. But that doesn't answer my question.
joshstrange 10mo ago
I still remember the original announcement around LE and thought "Great idea, no idea if they'll be able to get buy-in from browsers/etc", now I use it on all my self-hosted sites and will probably be transitioning my employer over to it when we switch to automated renewal sometime next year. LE has been an amazing resource and every time I setup a new website and get a LE cert I smile. Especially after having lived/experienced the pain that was SSL/TLS before LE.
- ekr____ 10mo ago
  We actually spent some time making sure that we weren't going to run into problems with browsers. However, as the OP points out, because LE had a cross-signature from an existing CA, browsers didn't have to any positive action to make LE certificates work. This was absolutely essential to getting things off the ground.
  - joshstrange 10mo ago
    Oh, I know you all did and I remember the cross-signing. I worried that you'd get slapped down somehow, that the crappy cert companies would find a way to stop/reverse it, that the project would fizzle out, etc. I thought it was cool as hell but it seemed something so clearly good couldn't stay good but you all have only gotten better over time.
deleted 10mo ago
[deleted]
hinkley 10mo ago
The thing that has made me feel the oldest this week is that someone I used to mentor posted a holiday pictures with visible wrinkles. If people you think are young look old, then buddy, check the mirror. But this is a close second. 10 years? That can't be right. Even accounting for Covid Time Dialation.
letsgetreal 10mo ago
Let's Encrypt allows anyone to have secure https communication, sure, but it doesn't address the question of website authenticity. I groan when I'm on an e-commerce site and I click on the browser URL lock icon and see a Let's Encrypt certificate because frankly anyone can create one for no cost and I don't know if it's the real website or if I made a URL typo. Say what you will about the expensive cert providers, but it's reassuring when you see DigiCert or Sectigo - with a company name and the address of the head office.
- tptacek 10mo ago
  It was never a reasonable goal of the WebPKI to authenticate entities; only to help establish end-to-end encryption between unrelated parties on the Internet. The WebPKI can ensure you're talking to whoever controls `ycombinator.com`, but it has to be up to some other layer of the security stack to decide whether you want to be talking to `ycombinator.com`. (This is in fact part of the logic behind FIDO2 and phishing-proof authentication).
  - letsgetreal 10mo ago
    FIDO2 doesn't solve the first website contact trust problem - only the HTTPS certificate does that.
    - tptacek 10mo ago
      It's good to want things!
  - schoen 10mo ago
    > It was never a reasonable goal of the WebPKI to authenticate entities The confusing thing is that this goal nonetheless appeared in some original marketing and explanations about the web PKI from the late 1990s when it was first introduced. There was another smaller burst of this when people were arguing over the formalization of DV certificates and of Google's UI changes that stopped treating EV specially (as some people found both of those changes objectionable). I agree with you that the goal of authenticating entities was impractical, but the mental association and expectation around it still hasn't been completely dispelled. (I think I saw some form of this when doing support on the Let's Encrypt Community Forum, as people would sometimes complain that a site shouldn't have been allowed to have a certificate, either because it wasn't the organization they expected, or because it was malicious somehow.)
pedrozieg 10mo ago
It’s easy to forget how awful TLS was before Let’s Encrypt: you’d pay per-hostname, file tickets, manually validate domains, and then babysit a 1-year cert renewal calendar. Today it’s basically “install an ACME client once and forget it” and the web quietly shifted from <30% HTTPS to ~80% globally and ~95% in the US in a few years. The impressive bit isn’t just the crypto, it’s that they attacked the operational problem: automation (ACME), good client ecosystem, and a nonprofit CA that’s fine with being invisible infrastructure. A boring, free cert became the default. The next 10 years feel harder: shrinking lifetimes (45-day certs are coming) means “click to install cert” can’t exist anymore, and there’s still a huge long tail of internal dashboards, random appliances, and IoT gear that don’t have good automation hooks. We’ve solved “public websites on Linux boxes,” but not “everything else on the network.”
- simcop2387 10mo ago
  For IoT myself i'm wondering if it's something that could be thrown into the Matter side of things, make the hub/border router act as an ACME server with it's own CA that gives out mTLS certs so the devices can validate the hub and the hub can validate the devices. It'd never be implemented properly by the swarms of cheap hardware out there but I can dream...
  - kbolino 10mo ago
    But why? There's no reliable source of truth for your home network. Neither the local (m)DNS nor the IP addresses nor the MAC addresses hold any extrinsic meaning. You could certainly run the standard ACME challenges, but neither success nor failure would carry much weight. And then the devices themselves have no way of knowing your hub/router/AP is legitimate. You'd have to have some way of getting the CA certificate on to them that couldn't be easily spoofed. EDIT: There is a draft for a new ACME challenge called dns-persist-01, which mentions IoT, but I'm not really sure how it helps that use case exactly: https://datatracker.ietf.org/doc/html/draft-ietf-acme-dns-persist https://datatracker.ietf.org/doc/html/draft-ietf-acme-dns-pe...
- cortesoft 10mo ago
  Just a few months ago my company was going through some transitions and wanted to get some certs to cover us while we migrated to a different stack with let's encrypt and automated cert renewals. We had some legacy systems on our network that needed certs and had various subdomains that prevented us from just having a wildcard cert. It ended up that we needed a few dozen subdomains with wildcard certs for each, and it was all for internal traffic between them. The company we were using wanted to charge us $30,000 for a one year cert with that many wildcards. We said fuck that, created our own CA, generated a big wildcard cert, and then installed the CA on the few thousand servers as a trusted root. A few months later and we are just using let's encrypt for everything, for free. I can't believe there is a market for $30,000 certs anymore. We were just shocked that that was deemed a reasonable price to charge us.
deleted 10mo ago
[deleted]
mmooss 10mo ago
Another amazing success born at Mozilla: "The Let's Encrypt project was started in 2012 by two Mozilla employees, Josh Aas and Eric Rescorla, together with Peter Eckersley at the Electronic Frontier Foundation and J. Alex Halderman at the University of Michigan." https://en.wikipedia.org/wiki/Let%27s_Encrypt https://en.wikipedia.org/wiki/Let%27s_Encrypt What was Mozilla's role, beyond conception? Parenting? Care and feeding? A roof?
- tptacek 10mo ago
  You can ask them; both Josh and Eric are HN people, and Erik is already on this thread. :)
- ekr____ 10mo ago
  A lot of this is covered in the Let's Encrypt retrospective paper from 2019: https://www.abetterinternet.org/documents/letsencryptCCS2019.pdf https://www.abetterinternet.org/documents/letsencryptCCS2019.... From Section 3.1. "Let’s Encrypt was created through the merging of two simultaneous efforts to build a fully automated certificate authority. In 2012, a group led by Alex Halderman at the University of Michigan and Peter Eckersley at EFF was developing a protocol for automatically issuing and renewing certificates. Simultaneously, a team at Mozilla led by Josh Aas and Eric Rescorla was working on creating a free and automated certificate authority. The groups learned of each other’s efforts and joined forces in May 2013. ... Initially, ISRG had no full-time staff. Richard Barnes of Mozilla, Jacob Hoffman-Andrews of EFF, and Jeff Hodges (under contract with ISRG) began developing Let’s Encrypt’s CA software stack. Josh Aas and J.C. Jones, both with Mozilla at the time, led infrastructure development with assistance from Cisco and IdenTrust engineers. ISRG’s first full-time employee, Dan Jeffery, joined in April 2015 to help prepare the CA’s infrastructure for launch. Simultaneously, James Kasten, Peter Eckersley, and Seth Schoen worked on the initial ACME client (which would eventually become Certbot) while at the University of Michigan and EFF. Kevin Dick of Right Side Capital Management, John Hou of Hou & Villery, and Josh Aas constituted the team responsible for completing a trusted root partnership deal and signing initial sponsors."
nixpulvis 10mo ago
Is there a notion of tier 1 and tier 2 certificates? Like if I setup paid and backed by contract agreements with a cert provider, does this give users more confidence that their lock icon in the browser actually means they are talking to who they think they are? It's one thing to provide a cert to provide secure encrypted TLS, it's another thing to establish identity with the user. Though, most users would never notice either way.
- kbolino 10mo ago
  There are Extended Validation (EV) certificates, and for a couple of years browsers gave them special treatment (typically, a green lock indicator instead of gray, sometimes accompanied by the validated business name). However, they were eventually demoted to the same appearance as ordinary Domain Validation (DV) certificates for a couple reasons: 1) This is not as useful as it sounds. Business names are not unique, and the legal entity behind a legitimate business may have a different name that no one has ever heard of. 2) Validation gets dicier as the world gets opened up and as laws and customs change. The higher tier confers greater prestige and legitimacy, but the only discriminator really backing it is money.
  - nixpulvis 10mo ago
    Yea, this was what I thought I'd dealt with before but I couldn't remember. It's too bad the same hasn't happened to software notarization and signing systems. People will argue that having payments enforced some accountability, but I'm not really convinced.
phillipseamore 10mo ago
10 great years. For the next years I'm hoping for more resilience/global distribution in the issuance process. Since I live on an island for about half the year I do have experience with internet outages, and we do appear to live in turbulent times. That could be an issue with the ever decreasing certificate lifetime. I'd love to see LE exploring options like working with ccTLD registrars to work on local issuance.
mpingu 10mo ago
That is awesome i love how you change the TLS Scene for ever! Keep pushing it!
deleted 10mo ago
[deleted]
ZebusJesus 10mo ago
They helped change the security game, hats off to Let's Encrypt making it accessible. I remember when people would get upset about having to pay 400$ for a cert from go daddy nearly 2 decades ago. Google pushing the HTTPs requirement was also a good thing and Let's Encrypt made it possible for many that otherwise wouldn't have bought a cert in the first place.
amelius 10mo ago
Next step: Let's Tor?
racl101 10mo ago
Just 10, it feels like more.
nodesocket 10mo ago
Would be interesting to hear what database they are using and how they are doing replication? Is it simple master / slave or multi-master?
- Ayesh 10mo ago
  https://github.com/letsencrypt/boulder https://github.com/letsencrypt/boulder You can find a docker-compose.yml file to get some idea. Appears to be using MariaDB. They shut down OCSP responders and expiry email reminders, so there really is no need to have a database apart from rate limits, auth data, and caching. For Certificate Transparency, they are submitted to Google and CloudFlare run trees but I don't think LetsEncrypt run their own logs.
  - nodesocket 10mo ago
    I assume they want to store metadata instead of having to pull from the certificates itself, but maybe that’s actually easier and more performant.
  - mcpherrinm 10mo ago
    Let’s Encrypt does operate CT logs. I wrote a blog post about our current-generation logs at https://letsencrypt.org/2024/03/14/introducing-sunlight https://letsencrypt.org/2024/03/14/introducing-sunlight
- mcpherrinm 10mo ago
  Let’s Encrypt currently has a single primary with a handful of replicas, split across a primary and backup DC. We’re in progress of adopting Vitess to shard into a handful of smaller instances, as our single big database is getting unwieldy.
  - nodesocket 10mo ago
    Thanks. Would love to see a tech blog post once you get Vitess implemented.
cyberax 10mo ago
The next steps: 1. Add support for DNS-based persistent authentication: https://datatracker.ietf.org/doc/draft-ietf-acme-dns-persist/ https://datatracker.ietf.org/doc/draft-ietf-acme-dns-persist... 2. Allow the user to just publish their public key into that TXT record. 3. Cut out the middleman and do the authentication directly in the browser. 4. DANE
- tptacek 10mo ago
  DANE isn't going to happen, and if you want to tilt at that windmill, it's Chrome and Mozilla you need to pressure, not LetsEncrypt.
  - cyberax 10mo ago
    I mean, these are the steps that can bring it. And with Let's Encrypt as a safe fallback, it actually is feasible this time. Long shot? Yes. But not impossible.
    - tptacek 10mo ago
      The first step you'd need is a reliable way to deliver DNSSEC records to browsers, which does not currently exist. So I feel like you're missing at least a step 0, if not a step -1 (of getting ~anybody to actually sign zones.)
      - kbolino 10mo ago
        Aren't browsers generally implementing their own DNS resolution (via DoH) nowadays anyway? Not sure it helps that much, but operating systems not enforcing/delivering DNSSEC seems like a side-stepped problem now.
        tptacek 10mo ago
        No, not as a general rule they aren't. And remember, the DNSSEC record delivery problem isn't an issue for the majority of all browser sessions, just a small minority that are on paths that won't pass DNSSEC records reliably. Since you can't just write those paths off, and you can't really reliably detect them, you end up needing a resolution fallback --- at which point you might as well not be using DANE. This was a big enough issue that there was a whole standards push to staple DNSSEC records to the TLS handshake (which then fell apart).
1970-01-01 10mo ago
Getting yourself an IP address certificate still seems like an idea that's too crazy to work. I'm actually looking forward to seeing all the things breaking by becoming more secure.
bruvva 10mo ago
This is something that legitimately made the world a better place.
omani 10mo ago
only downside to LE is the attack surface presented by CTLs (Certificate Transparency Logs). as soon as you request a cert, you will get attacks on the endpoint/subdomain you have registered by countless IPs trying to login etc.
RandyOrion 10mo ago
Thank you Let's Encrypt, together with the acme.sh , caddy and the whole ecosystem for TLS. You simply cannot emphasize the information security enough if all your Internet traffic is audited, censored and manipulated by a number of adversaries supported by (authoritarian) governments and what not.
- 8cvor6j844qw_d6 10mo ago
  Caddy's way of using plugins seems to require building custom binaries, may I know if that's what you did? I preferred to use wildcard certs, which requires a plugin for the dns
  - RandyOrion 10mo ago
    Well, I use Arch Linux and the caddy package from pacman just works. You may checkout https://github.com/caddyserver/xcaddy https://github.com/caddyserver/xcaddy for custom caddy build. Besides, I don't use wildcard certs. I use caddy to reverse proxy a number of self-hosting things, and manually assign domain names to each of them. Caddy can handles many certs just fine.
    - 8cvor6j844qw_d6 10mo ago
      I plan to make use of a Caddy on a cheap VPS to expose some self-hosted services behind Tailscale, behind Caddy will be a mix of Raspberry Pi and a occasional hosted VPS when trying things out. How's your experience with Caddy regarding memory usage? I am currently serving a static site with 500 MB, but this is with very low to zero traffic.
      - RandyOrion 10mo ago
        I see 3-4% of 1GB ram usage for caddy only. Note that in my case caddy serves as reverse proxy and there is also very little traffic.
tempaccountabcd 10mo ago
[dead]
dilawar 10mo ago
A couple of years ago, I went through the process of signing a kenel minifiter that I wrote for our endpoint-security product. It was complicated, to put it mildly. Imagine if we had a similar process for websites! Thanks Let's Encrypt.
nofunsir 10mo ago
Still not convinced it's not a honeypot. Would like to see concrete evidence.
Gud 10mo ago
I use Let’s Encrypt. It is an amazing service and I am forever grateful. However, it is time for a second source of free certificates. It is not good that we rely on one supplier.
- a-l-e-c 10mo ago
  I only recently realized that Caddy by default uses LetsEncrypt and ZeroSSL, so seems like there already is an alternative. Haven't used it myself yet
stephenr 10mo ago
10 years and still no S/MIME.
elnerd 10mo ago
One domain parking actor is responsible for nearly 10% of all issued ssl certificates. 185.53.178.99. This is just one of many bad actors.
- roflmaostc 10mo ago
  This belongs to a German company called Team Internet AG [1]. Are they really a bad actor? What's the reason to issue so many SSL certificates? https://www.whois.com/whois/185.53.178.99 https://www.whois.com/whois/185.53.178.99
  - KronisLV 10mo ago
    > What's the reason to issue so many SSL certificates? Might be related to https://www.teaminternet.de/en/parkingcrew https://www.teaminternet.de/en/parkingcrew
    - roflmaostc 10mo ago
      Interesting. Personally I find it questionable to squat so many domains for ads. But they pay for it and it is within the legal framework.
janpmz 10mo ago
What else is kept behind paperwork and fees that could be freed?
rswail 10mo ago
The pathetic part of EVs is that they should have been issued by whatever the business register/regulator is in the country of issue. Not some arbitrary group like D&B etc. The US/other countries should have ensured that each state/registration area had an appropriate cert to sign with. It should be part of my company's annual registration/reporting expenses that they issue the appropriate certificate for "*.<mycompany>.<2LDs>.<gTLD>", signed by them (and by the TLD root cert of the nation of registration).
- crote 10mo ago
  Companies probably prefer to use "apple.com" instead of "apple-computer-inc.co.ca.us". It's even worse if you want to use truly unique identifiers like ISIN, LEI, DUNS, or IBRN, as that means something closer to "US0378331005.com".
  - rswail 10mo ago
    The point is that I (as an Australian) don't trust a private organization like D&B any more than any other organization. Corporate existence is dependent on some form of government regulator granting the corporation existence. If EVs are/were a good idea (debatable at best), then having those EVs issued by the same government regulator that allows corporates to use trademarks etc makes sense. If "apple" is a trademark for computers, then Apple Computer Inc as the owner of that trademark should get an EV issued by the regulator of trademarks. Of course, the URL should be apple.com.us or apple.tm.us. The historical error was not requiring the US to move to 2LDs for it's com/org/net/gov/mil etc domains. Note this is for corporate entities, none of which exist outside regulatory environments.
KronisLV 10mo ago
Cloudflare: "Oh no, we can't have that much centralization, that's horrible, just think of the impact outages have!" Let's Encrypt: crickets Obviously I use LE myself and like what they do, and even in the example above some downtime would have less of an impact than Cloudflare would (due to renewals being less time sensitive), I'm just surprised that there aren't like 5 other orgs that do the same at scale, like an EU based one for example. If there's a lot of domain registrars, why doesn't every single one of them have ACME compatible services? I think there was ZeroSSL but I vaguely remember something scummy about upsells there a few years back.
- iso1631 10mo ago
  If LE goes down for a week you can't deploy new certs, but your existing ones will work, as you renew them a few weeks before expiry anyway That also gives you enough time to change to get your certs from elsewhere As you mention zerossl exista, and I think google GCM will give you free certs too. Globalsign has an ACME interface for paying customers, although I'm told it has issues (you have to rotate keys manually every X days / N certificates)
  - DaSHacka 10mo ago
    > If LE goes down for a week you can't deploy new certs, but your existing ones will work, as you renew them a few weeks before expiry anyway Assuming certificate expiration times remain over 7 days per certificate.
    - iso1631 10mo ago
      There's no (current) plans to drop below 45 day certificates with an expected renewal with 2 weeks to go. I agree if cert lifetimes drop towards week long then it becomes problematic. A sensible thing at that point is to ensure you can issue certificates from different CAs on different underlying stacks, in the same way you use multiple DNS servers
martinclayton 10mo ago
Seems Let's Encrypt also have control of https://letsdecrypt.org https://letsdecrypt.org. It takes you to https://www.nsa.gov https://www.nsa.gov rather than Let's Encrypt. Not sure what to make of that!
- fluoridation 10mo ago
  letsdecrypt.org doesn't load for me.
  - cess11 10mo ago
    Here's a curl from my connection: $ curl -v letsdecrypt.org * Host letsdecrypt.org:80 was resolved. * IPv6: (none) * IPv4: 62.116.130.8 * Trying 62.116.130.8:80... * Connected to letsdecrypt.org (62.116.130.8) port 80 * using HTTP/1.x > GET / HTTP/1.1 > Host: letsdecrypt.org > User-Agent: curl/8.14.1 > Accept: */* > * Request completely sent off < HTTP/1.1 301 Moved Permanently < Server: nginx < Date: Wed, 10 Dec 2025 15:20:48 GMT < Content-Type: text/html; charset=UTF-8 < Transfer-Encoding: chunked < Connection: keep-alive < X-Redirector-ID: 14c2d856bcd2de3beae30791793b40ae43db49fc9ea482a825177a36e20108c4 < Location: http://www.nsa.gov/ < IX-Cache-Status: MISS < * Connection #0 to host letsdecrypt.org left intact Seems to be hosted by InterNetX GmbH. Edit: Ah, over HTTPS protocol it doesn't respond. $ curl -v https://letsdecrypt.org * Host letsdecrypt.org:443 was resolved. * IPv6: (none) * IPv4: 62.116.130.8 * Trying 62.116.130.8:443... Web browsers that add it automatically probably get stuck.
- zamadatix 10mo ago
  http://letsdecrypt.org http://letsdecrypt.org, no encryption on letsdecrypt :).
- einsteinx2 10mo ago
  Seems like a joke, including the fact it is only acceptable over HTTP.
hgs3 10mo ago
Congratulations to Let’s Encrypt. I do wish there was something akin to them for code signing. OV and EV certificates are out of reach for many indie devs.
chuckreynolds 10mo ago
Seems longer than 10 years ago? But hey... Let's Encrypt absolutely changed the game... TLS and certificates were a huuuuuge PITA and expensive... we only used them when money was moving around online and they were slow most times. It was also a process to add one, update one, etc. I remember not trusting it at first because it was so easy lol. THANK YOU Let's Encrypt... you made us all more sane, saved time, and secured us all up too. Firm handshakes.
- ericmcer 10mo ago
  Thats what I thought when I read this too, I feel like they have been around forever. Guess a lot has happened in 10 years.
chasd00 10mo ago
I love Let's Encrypt A small VPS + LetsEncrypt + Dokku is a fantastic way to run personal side projects/hustles at minimal cost.
ge96 10mo ago
I remember buying certs from Godaddy then Namecheap then using Let's Encrypt feels like when GitHub offered free private repos
scotty79 10mo ago
I probably downloaded terabytes of data from the internet unnecessarily because https everywhere makes makes it prohibitively complicated to setup local caching proxy. No to mention time lost waiting for downloads to finish. I'll never understand why caching proxy is not a default part of every OS.
xnx 10mo ago
Let's Encrypt is awesome. Is there any other ridiculously overpriced good/service that could be Let's Encrypt'ed today?
1vuio0pswjnm7 10mo ago
https://community.letsencrypt.org/t/revoking-certain-certificates-on-march-4/114864/7 https://community.letsencrypt.org/t/revoking-certain-certifi... https://community.letsencrypt.org/t/2020-02-29-caa-rechecking-bug/114591 https://community.letsencrypt.org/t/2020-02-29-caa-recheckin... https://bugzilla.mozilla.org/show_bug.cgi?id=1619047 https://bugzilla.mozilla.org/show_bug.cgi?id=1619047 https://www.theregister.com/2020/03/03/lets_encrypt_cert_revocation/ https://www.theregister.com/2020/03/03/lets_encrypt_cert_rev...
johndoh42 10mo ago
10 years of solving a problem that didn't exist, and creating a few dozen new ones in the process. Not evening mentioning the massive security risk they pose; Well, I did now.

817 points by SGran 10mo ago

victorbjorklund 10mo ago

Wow. Feels like Let’s encrypt been around for longer.

Aardwolf 10mo ago
Agreed! What were we using before Let's Encrypt again? Maybe just plain HTTP
- bakies 10mo ago
  Self signed certs. I wasn't paying.
  - Thaxll 10mo ago
    Some of them were not expensive but it was not convenient at all.
- rew0rk 10mo ago
  either you used http, self signed if you did not mind the warning, and i remember there being one company that did offer free certificates that validated, but cant remember the name of it
  - tomklein 10mo ago
    I believe it was StartSSL and/or WoSign back then
  - SahAssar 10mo ago
    > i remember there being one company that did offer free certificates that validated, but cant remember the name of it You're probably thinking of StartSSL, and it was a bit of a pain to get it done.
- deleted 10mo ago
  [deleted]
- asadotzler 10mo ago
  SSL/TLS via expensive and hard to work with providers and tooling. Let's Encrypt made it free and easy to maintain.
- ZeroConcerns 10mo ago
  Mostly Verisign, which required faxing forms and eye-watering amounts of money. Then Thawte, which brought down prices to a more manageable US$500 per host or so. Which might seem excessive, but was really peanuts compared to the price of the 'SSL accelerator' SBus card that you also needed to serve more than, like, 2 concurrent HTTPS connections. And you try telling young people that ACME is a walk in the park, and they won't believe you...
  - anamexis 10mo ago
    And then sketchy resellers for Verisign/Thawte, which were cheap but invariably had websites that ironically did not inspire confidence in typing in your credit card number.
  - dylan604 10mo ago
    As GP posited, because of this headache, lots of web traffic was plain ol' HTTP. Let's Encrypt is owed a lot of credit for drastically reducing plain ol' HTTP.
- SirMaster 10mo ago
  I was using StartCom StartSSL which was offering free 1 year certificates at least for my personal sites.
  - 0x0 10mo ago
    They were great in the beginning, and then when you issued a few more certs than they liked you were asked to pony up some $$$, and then when you did that and actually "verified" who you were on a personal international phone call, you got a grace, and then issued a few more, they decided they didn't like you so they would randomly reject your renewals close to the expiration date, and then they got bought out by some scummy foreign outfit which apparently caused the entire CA to be de-listed as untrustworthy in all major browsers. Quite the ride. Also, the only website I've ever encountered that actually used the HTML <keygen> tag.
- 1f60c 10mo ago
  The pros were using client-side encryption :D
quesera 10mo ago
I was going to say the opposite. LE still feels like the "new" way, to me. :)

jjice 10mo ago

Let's Encrypt was _huge_ in making it's absurd to not have TLS and now we (I, at least) take it for granted because it's just the baseline for any website I build. Incredible, free service that helped make the web a more secure place. What a wonderful service - thank you to the entire team. The CEO at my last company (2022) refused to use Let's Encrypt because "it looked cheap to customers". That is absurd to me because 1), it's (and was at the time) the largest certificate authority in the world, and 2) I've never seen someone care about who issued your cert on a sales call. It coming from GoDaddy is not a selling point... So my question: has anyone actually commented to you in a negative way about using Let's Encrypt? I couldn't imagine, but curious on others' experiences.

rokkamokka 10mo ago
No! Let's encrypt is easily the best thing that's happened for a secure internet the last 10 years.
- DaSHacka 10mo ago
  And equally as much for a centralized internet...
johnebgd 10mo ago
There are extended certificates that did matter in our sales process for some hosted solutions back about 15 years ago if I recall right… no one has ever cared since…
giancarlostoro 10mo ago
> It coming from GoDaddy is not a selling point... I just people who use GoDaddy. They were the one company supporting SOPA when the entire rest of the internet was opposed to SOPA. It's very obvious GoDaddy is run by "business-bros" and not hackers or tech bros.
- dylan604 10mo ago
  This is my feeling as well. Finding out someone uses GoDaddy is a bit of a shibboleth.

npodbielski 10mo ago

I am glad to be one of the users using that for around 7 years. I can't think of how much better is life of people just doing blogs or some silly websites with free https certs. Would I pay 50$ bucks a year for ability to self host nextcloud? Probably not. But security enhancement is so enormous with that service. Thanks to everyone involved for making world a little bit better.

greyface- 10mo ago

New baseline expectation that web traffic will be encrypted on the wire: very good! New de-facto requirement that you need to receive the blessing of a CA to make use of basic web platform features... not so good.

jovial_cavalier 10mo ago
That's not new, LetsEncrypt just didn't solve it. And if you think this is the only single point of failure in the stack, I have news for you.
- greyface- 10mo ago
  It's absolutely new. No HTML5 features were restricted to secure origins only pre-LE. Today, many are. Google was able to push these requirements in large part due to Let's Encrypt's success making secure origins ubiquitous.
  - ekr____ 10mo ago
    The order of events is a bit more complicated than this. Google initially proposed restricting powerful features to secure origins back in February of 2015 (https://web.archive.org/web/20150125103531/https://www.chromium.org/Home/chromium-security/prefer-secure-origins-for-powerful-new-features/ https://web.archive.org/web/20150125103531/https://www.chrom...) and Mozilla proposed requiring secure origins for all new features in April of 2015 (https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-http/ https://blog.mozilla.org/security/2015/04/30/deprecating-non...). Let's Encrypt issued its first certificate in September of 2015. This isn't to say that these two things are unrelated: Mozilla obviously knew about Let's Encrypt and we considered it an important complement for this kind of policy, and at least some people at Chrome knew about LE, though I'm not sure how it played into their thinking. However, it's not as simple as "LE happened and then people started pushing for secure origins for new features".
    - bruce511 10mo ago

hulitu 10mo ago

> 10 Years of Let's Encrypt Aren't they only 45 days [1] old ? [1] https://letsencrypt.org/2025/12/02/from-90-to-45 https://letsencrypt.org/2025/12/02/from-90-to-45

p2detar 10mo ago
Not sure if you're joking or not, but I have to deal with this upcoming change at some point and still haven't read in detail why they decided to do this. Could anyone clarify?
- chippiewill 10mo ago
  Lets Encrypt are doing is because of the decision that CAs and browser makers made that it needs to be reduced (browsers have been reducing the length of certs that they trust). The why is because it's safer: it reduces the validity period of private keys that could be used in a MITM attack if they're leaked. It also encourages automation of cert renewal which is also more secure. It also makes responding to incidents at certificate authorities more practical.
  - dingaling 10mo ago
    > it reduces the validity period of private keys that could be used in a MITM attack if they're leaked If a private key is leaked, 45 days is sufficient to clean-out the accounts of all that company's customers. It might as well be 10 years. If cert compromise is really common enough to require a response then the cert lifetime should be measured in minutes.
- bifurcation 10mo ago
  Hi there, ISRG co-founder and current board member here. In brief, shorter lifetimes force people to automate (which, e.g., avoids outages from manual processes) and mitigates the broken state of revocation in the Web PKI. That latter point especially is what I understand to be driving the Web PKI toward ever-shorter lifetimes. I actually remember the discussion we had in ~2014 about what the default certificate lifetime should be. My opening bid was two weeks -- roughly the lifetime of an OCSP response. The choice to issue certificates with 90 day lifetimes was still quite aggressive in 2015, but it was a compromise with an even more aggressive position.

Decoy1008 10mo ago

I am so grateful for this. Bummer that they stopped with the email reminder, anyways I was wondering how this would work without active payments. Still amazing.

callumgare 10mo ago
Out of interest why do you care? I assume you’re using acme to automate renewals. Is it in case that fails? Or do you work with some system that can’t be automated?
- tempaccountabcd 10mo ago
  [dead]
- eeixlk 10mo ago
  Literally just got bit by this. I added a wildcard domain to a cert servicing multiple sites. Apparently the verification process for wildcards is more onerous and even when you have it working it wont renew in the same way as a normal cert. It requires specific workarounds based on your dns provider. Appreciative that we moved away from paid certs that required manual work to renew every year but this feels like a mismanaged backslide.

sam_lowry_ 10mo ago

[flagged]

jsheard 10mo ago
It's not like Let's Encrypt is the only game in town, Actalis in Italy provides free ACME certs too if you'd prefer to keep things in Europe.
- charlesbarbier 10mo ago
  Not sure if there is a point to "keep things in Europe" when it come to certificate authority. - LetsEncrypt don't have the private key tied to your certificate - Any of the Certificate Authorities could potentially emit unauthorized certificate Your only protection for all of these problems is HPKP. If you prefer to keep things in Europe, keep that pinned private key in Europe, but the rest doesn't matter. That said, it's pretty nice that LetsEncrypt forced the ACME protocol on this industry. Not only it create redundancy with mostly interchangeable alternatives but before ACME, there was no way to fully automate certificate provisioning cleanly.
  - bifurcation 10mo ago
    Just to clear up one point -- Let's Encrypt did not at all force ACME on the industry. We deliberately took it to the IETF so that we could get input from more parts of the industry (including some major refactors!). Instead of pressure from Let's Encrypt, I would attribute its success to the open process of the IETF, the awesome open-source community that made great ACME software (shoutout to Matt and Caddy!), and the resulting pressure on CAs for a better user experience from users and customers.
    - charlesbarbier 10mo ago
      I didn't express myself well but what I meant by force is that by building a standardized to automate way manage certificate, ACME imposed itself and became mandatory. Previously, most CA had no programmatic way to order certificate, it was all done manually. As far as I know, the only providers with that would let you automate certificate provisioning at the time where Comodo, GlobalSign and Digicert. They all had their own quirky API. Just to give you an idea, we ended up selecting GlobalSign at Shopify a few years before LetsEncrypt, and it was this SOAP nightmare: https://www.globalsign.com/en/repository/GlobalSign_Client_API_User_Guide.pdf https://www.globalsign.com/en/repository/GlobalSign_Client_A... At first none of them were warm at the idea of providing an ACME endpoint. I'm assuming part of it is the cost of implementing it but they probably liked the stickiness of their custom APIs too tied to million dollars contracts. Nowadays they all implement ACME. At some point, they where effectively forced to implement it to acquire new customers and keep their existing base around because nobody would accept poorly designed custom made protocol anymore.

asim 10mo ago

As a sysadmin in the 2007-2011 timeframe I literally used openssl to generate csrs, went to godaddy to purchase SSL certificates and then manually deployed them to servers. Man what a world of change. Let's encrypt is one the best services we've had on the internet. I wish we had more things like this.

par 10mo ago
i was doing this until a couple years back when a friend told me about LetsEncrypt! It's like magic!!
amatecha 10mo ago
Ah man, I remember those days. So tedious!
noAnswer 10mo ago
Would be cool to have it for S/MIME too.
Ayesh 10mo ago
It's been a long time so this is my fading memory, but CAs used to generate a private key on their end and let you download both private key and the certificate containing the public key. The non-technical person who paid big money for the certificate then emails the zip file to the developer. That's when StartTLS wasn't that big back then either. Just comically bad way to obtain certs.
- j16sdiz 10mo ago
  Many CA have in browser javascript-based private key generation. (Of course the same page have GoogleAnalytics and facebook button -- otherwise it would be too secure.)
merpkz 10mo ago
As a sysadmin in 2020 - 2024 time frame I used to do that all the time at my previous job, got a strong openlssl cli game going whenever needed to generate a new csr for existing key or new key and shovel an exact amount of SANs into the CSR too. Lot of time wasted. There were also a certain set of customers for which we managed systems and they insisted for it to be done this way as something free on the internet is not to be trusted. Oh well, strange times.

scblock 10mo ago

LE has been really great, particularly in running hobby web sites on the public internet. Getting certbot up and running wasn't hard, automating renewal wasn't hard, and because they have DNS-based pathways to verification you can use LE certificates for sites not exposed to the public internet as well. Combine it with something like Caddy and getting SSL for an app becomes the default without ever having to manage certificates by hand. I find it pretty amazing how far its come, and how big a change it has made to the internet in the decade it's been operating.

jrochkind1 10mo ago

it is hard to believe it's been ten years.

tracker1 10mo ago

I'm not sure that I'm more surprised that it's only been 10 years or that it's been that long. I mean, that's a relatively quick turn around to pretty much dominate TLS certs to the point that it's the default for so many platforms... that HTTPS has become such a norm over the exception. On the other hand, has it really been that long, it seems just yesterday I was first trying to configure nginx for it. That said, since I discovered Caddy, I haven't really looked back, though I do use Traefik too. I mean, by comparison, it feels like IE6 took longer to die than Let's Encrypt has been around.

awaseem 10mo ago

Incredibly grateful for this project

ok123456 10mo ago

Snowden was the other big reason that TLS became the de facto standard for every site. Prior to that, the consensus was that you only really needed TLS if you were dealing with money and wasn't worth the hassle otherwise. You could sniff traffic from Facebook and Twitter easily. I remember listening to a talk given by an IRS investigator in around 2008 about how they were able to do a sting and shutdown illegal internet casinos. They collected a good bulk of that evidence from clear-text packet captures of gambling sessions and messages. He preemptively answered the question of whether encryption was a hurdle, by saying no one used it.

tptacek 10mo ago
This is a retcon. Facebook rolled out TLS in 2011, 2 years before Snowden, and went TLS-by-default within a month of the Snowden disclosures. Google Mail was TLS-by-default in 2010. TLS was a universal best practice long before 2013 --- by 2010, you'd have gotten a sev:hi vulnerability flagged on your site if you hadn't implemented TLS. SSLLabs was 2009; BEAST was 2011, and was a huge global news story because of how widely deployed TLS was.
- ok123456 10mo ago
  Yes. And I remember sniffing Facebook traffic in clear text in 2011. The fact remains that it was considered a significant engineering problem for them to deploy it. It was a "best practice" that most people rolled their eyes at. Most users and system owners didn't care unless money was being transacted. Between Snowden and ISPs injecting content into pages, the consensus changed.
  - tptacek 10mo ago
    The consensus obviously changed. It's just that it changed years before the Snowden leaks.
    - ok123456 10mo ago
      The adversarial nature of the US Government changed the threat model, and it moved from a "nice to have" best practice to a business necessity. They were caught red-handed undermining the privacy of US citizens by systematically exploiting infrastructure vulnerabilities, for example, in Google, where messages flowed in clear text within nominally trusted contexts.

stego-tech 10mo ago

Let’s Encrypt is something so amazingly valuable that I was certain it’d be killed dead within a year to prop up the existing SSL cert business. Congrats on a decade, ya’ll, here’s to many, many more in securing the free internet.

Havoc 10mo ago

Reminder that it’s a non profit

vadepaysa 10mo ago

LetsEncrypt is on my end of year Donate list for the past 5 years. With all modern browsers requiring HTTPS everywhere, a world without Let's Encrypt would be really difficult for indie developers. Thank You for an amazing product!

kyawzazaw 10mo ago

my friends work here! and it was founded by an alum from my school Macalester College

postbase 10mo ago

thank you for your service

t1234s 10mo ago

Lets hope they stay independent and never get acquired by Google or any other large tech company. You can imagine a web where SSL issuance is used as a tool to censor websites. I think most browsers have been made to make standard http sites look malicious to normal users.

mikeyouse 10mo ago
They're a nonprofit - so they can't be acquired like a typical for-profit company. They could in theory sell some assets but it'd be very convoluted if they were the core assets -- per US tax law, nonprofit assets must remain in the nonprofit world, so there's no risk of any tech company ruining them.
- xandrius 10mo ago
  I heard similar things about another American nonprofit and now I'm not so sure about it. When money and will comes along, loopholes come as well. So, I wouldn't be so sure, unfortunately.
- johncolanduoni 10mo ago
  Look at OpenAI - where there’s a will (and an army of lawyers), there’s a way. That said, I don’t think any of the big tech orgs would be interested in acquiring them. Google and Amazon even already have their own public CAs that are in the major trust stores.
deleted 10mo ago
[deleted]
crapple8430 10mo ago
If Google wants to censor your website, they have a variety of other, more effective methods, like by adding it to their safe browsing blacklist, which is also used in many Firefox installs.
- morshu9001 10mo ago
  Or even more apples to apples, they could ignore your cert in Chrome

hbn 10mo ago

Yes let's. But that doesn't answer my question.

joshstrange 10mo ago

I still remember the original announcement around LE and thought "Great idea, no idea if they'll be able to get buy-in from browsers/etc", now I use it on all my self-hosted sites and will probably be transitioning my employer over to it when we switch to automated renewal sometime next year. LE has been an amazing resource and every time I setup a new website and get a LE cert I smile. Especially after having lived/experienced the pain that was SSL/TLS before LE.

ekr____ 10mo ago
We actually spent some time making sure that we weren't going to run into problems with browsers. However, as the OP points out, because LE had a cross-signature from an existing CA, browsers didn't have to any positive action to make LE certificates work. This was absolutely essential to getting things off the ground.
- joshstrange 10mo ago
  Oh, I know you all did and I remember the cross-signing. I worried that you'd get slapped down somehow, that the crappy cert companies would find a way to stop/reverse it, that the project would fizzle out, etc. I thought it was cool as hell but it seemed something so clearly good couldn't stay good but you all have only gotten better over time.

deleted 10mo ago

[deleted]

hinkley 10mo ago

The thing that has made me feel the oldest this week is that someone I used to mentor posted a holiday pictures with visible wrinkles. If people you think are young look old, then buddy, check the mirror. But this is a close second. 10 years? That can't be right. Even accounting for Covid Time Dialation.

letsgetreal 10mo ago

Let's Encrypt allows anyone to have secure https communication, sure, but it doesn't address the question of website authenticity. I groan when I'm on an e-commerce site and I click on the browser URL lock icon and see a Let's Encrypt certificate because frankly anyone can create one for no cost and I don't know if it's the real website or if I made a URL typo. Say what you will about the expensive cert providers, but it's reassuring when you see DigiCert or Sectigo - with a company name and the address of the head office.

tptacek 10mo ago
It was never a reasonable goal of the WebPKI to authenticate entities; only to help establish end-to-end encryption between unrelated parties on the Internet. The WebPKI can ensure you're talking to whoever controls `ycombinator.com`, but it has to be up to some other layer of the security stack to decide whether you want to be talking to `ycombinator.com`. (This is in fact part of the logic behind FIDO2 and phishing-proof authentication).
- letsgetreal 10mo ago
  FIDO2 doesn't solve the first website contact trust problem - only the HTTPS certificate does that.
  - tptacek 10mo ago
    It's good to want things!
- schoen 10mo ago
  > It was never a reasonable goal of the WebPKI to authenticate entities The confusing thing is that this goal nonetheless appeared in some original marketing and explanations about the web PKI from the late 1990s when it was first introduced. There was another smaller burst of this when people were arguing over the formalization of DV certificates and of Google's UI changes that stopped treating EV specially (as some people found both of those changes objectionable). I agree with you that the goal of authenticating entities was impractical, but the mental association and expectation around it still hasn't been completely dispelled. (I think I saw some form of this when doing support on the Let's Encrypt Community Forum, as people would sometimes complain that a site shouldn't have been allowed to have a certificate, either because it wasn't the organization they expected, or because it was malicious somehow.)

pedrozieg 10mo ago

It’s easy to forget how awful TLS was before Let’s Encrypt: you’d pay per-hostname, file tickets, manually validate domains, and then babysit a 1-year cert renewal calendar. Today it’s basically “install an ACME client once and forget it” and the web quietly shifted from <30% HTTPS to ~80% globally and ~95% in the US in a few years. The impressive bit isn’t just the crypto, it’s that they attacked the operational problem: automation (ACME), good client ecosystem, and a nonprofit CA that’s fine with being invisible infrastructure. A boring, free cert became the default. The next 10 years feel harder: shrinking lifetimes (45-day certs are coming) means “click to install cert” can’t exist anymore, and there’s still a huge long tail of internal dashboards, random appliances, and IoT gear that don’t have good automation hooks. We’ve solved “public websites on Linux boxes,” but not “everything else on the network.”

simcop2387 10mo ago
For IoT myself i'm wondering if it's something that could be thrown into the Matter side of things, make the hub/border router act as an ACME server with it's own CA that gives out mTLS certs so the devices can validate the hub and the hub can validate the devices. It'd never be implemented properly by the swarms of cheap hardware out there but I can dream...
- kbolino 10mo ago
  But why? There's no reliable source of truth for your home network. Neither the local (m)DNS nor the IP addresses nor the MAC addresses hold any extrinsic meaning. You could certainly run the standard ACME challenges, but neither success nor failure would carry much weight. And then the devices themselves have no way of knowing your hub/router/AP is legitimate. You'd have to have some way of getting the CA certificate on to them that couldn't be easily spoofed. EDIT: There is a draft for a new ACME challenge called dns-persist-01, which mentions IoT, but I'm not really sure how it helps that use case exactly: https://datatracker.ietf.org/doc/html/draft-ietf-acme-dns-persist https://datatracker.ietf.org/doc/html/draft-ietf-acme-dns-pe...
cortesoft 10mo ago
Just a few months ago my company was going through some transitions and wanted to get some certs to cover us while we migrated to a different stack with let's encrypt and automated cert renewals. We had some legacy systems on our network that needed certs and had various subdomains that prevented us from just having a wildcard cert. It ended up that we needed a few dozen subdomains with wildcard certs for each, and it was all for internal traffic between them. The company we were using wanted to charge us $30,000 for a one year cert with that many wildcards. We said fuck that, created our own CA, generated a big wildcard cert, and then installed the CA on the few thousand servers as a trusted root. A few months later and we are just using let's encrypt for everything, for free. I can't believe there is a market for $30,000 certs anymore. We were just shocked that that was deemed a reasonable price to charge us.

deleted 10mo ago

[deleted]

mmooss 10mo ago

Another amazing success born at Mozilla: "The Let's Encrypt project was started in 2012 by two Mozilla employees, Josh Aas and Eric Rescorla, together with Peter Eckersley at the Electronic Frontier Foundation and J. Alex Halderman at the University of Michigan." https://en.wikipedia.org/wiki/Let%27s_Encrypt https://en.wikipedia.org/wiki/Let%27s_Encrypt What was Mozilla's role, beyond conception? Parenting? Care and feeding? A roof?

tptacek 10mo ago
You can ask them; both Josh and Eric are HN people, and Erik is already on this thread. :)
ekr____ 10mo ago
A lot of this is covered in the Let's Encrypt retrospective paper from 2019: https://www.abetterinternet.org/documents/letsencryptCCS2019.pdf https://www.abetterinternet.org/documents/letsencryptCCS2019.... From Section 3.1. "Let’s Encrypt was created through the merging of two simultaneous efforts to build a fully automated certificate authority. In 2012, a group led by Alex Halderman at the University of Michigan and Peter Eckersley at EFF was developing a protocol for automatically issuing and renewing certificates. Simultaneously, a team at Mozilla led by Josh Aas and Eric Rescorla was working on creating a free and automated certificate authority. The groups learned of each other’s efforts and joined forces in May 2013. ... Initially, ISRG had no full-time staff. Richard Barnes of Mozilla, Jacob Hoffman-Andrews of EFF, and Jeff Hodges (under contract with ISRG) began developing Let’s Encrypt’s CA software stack. Josh Aas and J.C. Jones, both with Mozilla at the time, led infrastructure development with assistance from Cisco and IdenTrust engineers. ISRG’s first full-time employee, Dan Jeffery, joined in April 2015 to help prepare the CA’s infrastructure for launch. Simultaneously, James Kasten, Peter Eckersley, and Seth Schoen worked on the initial ACME client (which would eventually become Certbot) while at the University of Michigan and EFF. Kevin Dick of Right Side Capital Management, John Hou of Hou & Villery, and Josh Aas constituted the team responsible for completing a trusted root partnership deal and signing initial sponsors."

nixpulvis 10mo ago

Is there a notion of tier 1 and tier 2 certificates? Like if I setup paid and backed by contract agreements with a cert provider, does this give users more confidence that their lock icon in the browser actually means they are talking to who they think they are? It's one thing to provide a cert to provide secure encrypted TLS, it's another thing to establish identity with the user. Though, most users would never notice either way.

kbolino 10mo ago
There are Extended Validation (EV) certificates, and for a couple of years browsers gave them special treatment (typically, a green lock indicator instead of gray, sometimes accompanied by the validated business name). However, they were eventually demoted to the same appearance as ordinary Domain Validation (DV) certificates for a couple reasons: 1) This is not as useful as it sounds. Business names are not unique, and the legal entity behind a legitimate business may have a different name that no one has ever heard of. 2) Validation gets dicier as the world gets opened up and as laws and customs change. The higher tier confers greater prestige and legitimacy, but the only discriminator really backing it is money.
- nixpulvis 10mo ago
  Yea, this was what I thought I'd dealt with before but I couldn't remember. It's too bad the same hasn't happened to software notarization and signing systems. People will argue that having payments enforced some accountability, but I'm not really convinced.

phillipseamore 10mo ago

10 great years. For the next years I'm hoping for more resilience/global distribution in the issuance process. Since I live on an island for about half the year I do have experience with internet outages, and we do appear to live in turbulent times. That could be an issue with the ever decreasing certificate lifetime. I'd love to see LE exploring options like working with ccTLD registrars to work on local issuance.

mpingu 10mo ago

That is awesome i love how you change the TLS Scene for ever! Keep pushing it!

deleted 10mo ago

[deleted]

ZebusJesus 10mo ago

They helped change the security game, hats off to Let's Encrypt making it accessible. I remember when people would get upset about having to pay 400$ for a cert from go daddy nearly 2 decades ago. Google pushing the HTTPs requirement was also a good thing and Let's Encrypt made it possible for many that otherwise wouldn't have bought a cert in the first place.

amelius 10mo ago

Next step: Let's Tor?

racl101 10mo ago

Just 10, it feels like more.

nodesocket 10mo ago

Would be interesting to hear what database they are using and how they are doing replication? Is it simple master / slave or multi-master?

Ayesh 10mo ago
https://github.com/letsencrypt/boulder https://github.com/letsencrypt/boulder You can find a docker-compose.yml file to get some idea. Appears to be using MariaDB. They shut down OCSP responders and expiry email reminders, so there really is no need to have a database apart from rate limits, auth data, and caching. For Certificate Transparency, they are submitted to Google and CloudFlare run trees but I don't think LetsEncrypt run their own logs.
- nodesocket 10mo ago
  I assume they want to store metadata instead of having to pull from the certificates itself, but maybe that’s actually easier and more performant.
- mcpherrinm 10mo ago
  Let’s Encrypt does operate CT logs. I wrote a blog post about our current-generation logs at https://letsencrypt.org/2024/03/14/introducing-sunlight https://letsencrypt.org/2024/03/14/introducing-sunlight
mcpherrinm 10mo ago
Let’s Encrypt currently has a single primary with a handful of replicas, split across a primary and backup DC. We’re in progress of adopting Vitess to shard into a handful of smaller instances, as our single big database is getting unwieldy.
- nodesocket 10mo ago
  Thanks. Would love to see a tech blog post once you get Vitess implemented.

cyberax 10mo ago

The next steps: 1. Add support for DNS-based persistent authentication: https://datatracker.ietf.org/doc/draft-ietf-acme-dns-persist/ https://datatracker.ietf.org/doc/draft-ietf-acme-dns-persist... 2. Allow the user to just publish their public key into that TXT record. 3. Cut out the middleman and do the authentication directly in the browser. 4. DANE

tptacek 10mo ago
DANE isn't going to happen, and if you want to tilt at that windmill, it's Chrome and Mozilla you need to pressure, not LetsEncrypt.
- cyberax 10mo ago
  I mean, these are the steps that can bring it. And with Let's Encrypt as a safe fallback, it actually is feasible this time. Long shot? Yes. But not impossible.
  - tptacek 10mo ago
    The first step you'd need is a reliable way to deliver DNSSEC records to browsers, which does not currently exist. So I feel like you're missing at least a step 0, if not a step -1 (of getting ~anybody to actually sign zones.)
    - kbolino 10mo ago
      Aren't browsers generally implementing their own DNS resolution (via DoH) nowadays anyway? Not sure it helps that much, but operating systems not enforcing/delivering DNSSEC seems like a side-stepped problem now.
      - tptacek 10mo ago
        No, not as a general rule they aren't. And remember, the DNSSEC record delivery problem isn't an issue for the majority of all browser sessions, just a small minority that are on paths that won't pass DNSSEC records reliably. Since you can't just write those paths off, and you can't really reliably detect them, you end up needing a resolution fallback --- at which point you might as well not be using DANE. This was a big enough issue that there was a whole standards push to staple DNSSEC records to the TLS handshake (which then fell apart).

1970-01-01 10mo ago

Getting yourself an IP address certificate still seems like an idea that's too crazy to work. I'm actually looking forward to seeing all the things breaking by becoming more secure.

bruvva 10mo ago

This is something that legitimately made the world a better place.

omani 10mo ago

only downside to LE is the attack surface presented by CTLs (Certificate Transparency Logs). as soon as you request a cert, you will get attacks on the endpoint/subdomain you have registered by countless IPs trying to login etc.

RandyOrion 10mo ago

Thank you Let's Encrypt, together with the acme.sh , caddy and the whole ecosystem for TLS. You simply cannot emphasize the information security enough if all your Internet traffic is audited, censored and manipulated by a number of adversaries supported by (authoritarian) governments and what not.

8cvor6j844qw_d6 10mo ago
Caddy's way of using plugins seems to require building custom binaries, may I know if that's what you did? I preferred to use wildcard certs, which requires a plugin for the dns
- RandyOrion 10mo ago
  Well, I use Arch Linux and the caddy package from pacman just works. You may checkout https://github.com/caddyserver/xcaddy https://github.com/caddyserver/xcaddy for custom caddy build. Besides, I don't use wildcard certs. I use caddy to reverse proxy a number of self-hosting things, and manually assign domain names to each of them. Caddy can handles many certs just fine.
  - 8cvor6j844qw_d6 10mo ago
    I plan to make use of a Caddy on a cheap VPS to expose some self-hosted services behind Tailscale, behind Caddy will be a mix of Raspberry Pi and a occasional hosted VPS when trying things out. How's your experience with Caddy regarding memory usage? I am currently serving a static site with 500 MB, but this is with very low to zero traffic.
    - RandyOrion 10mo ago
      I see 3-4% of 1GB ram usage for caddy only. Note that in my case caddy serves as reverse proxy and there is also very little traffic.

tempaccountabcd 10mo ago

[dead]

dilawar 10mo ago

A couple of years ago, I went through the process of signing a kenel minifiter that I wrote for our endpoint-security product. It was complicated, to put it mildly. Imagine if we had a similar process for websites! Thanks Let's Encrypt.

nofunsir 10mo ago

Still not convinced it's not a honeypot. Would like to see concrete evidence.

Gud 10mo ago

I use Let’s Encrypt. It is an amazing service and I am forever grateful. However, it is time for a second source of free certificates. It is not good that we rely on one supplier.

a-l-e-c 10mo ago
I only recently realized that Caddy by default uses LetsEncrypt and ZeroSSL, so seems like there already is an alternative. Haven't used it myself yet

stephenr 10mo ago

10 years and still no S/MIME.

elnerd 10mo ago

One domain parking actor is responsible for nearly 10% of all issued ssl certificates. 185.53.178.99. This is just one of many bad actors.

roflmaostc 10mo ago
This belongs to a German company called Team Internet AG [1]. Are they really a bad actor? What's the reason to issue so many SSL certificates? https://www.whois.com/whois/185.53.178.99 https://www.whois.com/whois/185.53.178.99
- KronisLV 10mo ago
  > What's the reason to issue so many SSL certificates? Might be related to https://www.teaminternet.de/en/parkingcrew https://www.teaminternet.de/en/parkingcrew
  - roflmaostc 10mo ago
    Interesting. Personally I find it questionable to squat so many domains for ads. But they pay for it and it is within the legal framework.

janpmz 10mo ago

What else is kept behind paperwork and fees that could be freed?

rswail 10mo ago

The pathetic part of EVs is that they should have been issued by whatever the business register/regulator is in the country of issue. Not some arbitrary group like D&B etc. The US/other countries should have ensured that each state/registration area had an appropriate cert to sign with. It should be part of my company's annual registration/reporting expenses that they issue the appropriate certificate for "*.<mycompany>.<2LDs>.<gTLD>", signed by them (and by the TLD root cert of the nation of registration).

crote 10mo ago
Companies probably prefer to use "apple.com" instead of "apple-computer-inc.co.ca.us". It's even worse if you want to use truly unique identifiers like ISIN, LEI, DUNS, or IBRN, as that means something closer to "US0378331005.com".
- rswail 10mo ago
  The point is that I (as an Australian) don't trust a private organization like D&B any more than any other organization. Corporate existence is dependent on some form of government regulator granting the corporation existence. If EVs are/were a good idea (debatable at best), then having those EVs issued by the same government regulator that allows corporates to use trademarks etc makes sense. If "apple" is a trademark for computers, then Apple Computer Inc as the owner of that trademark should get an EV issued by the regulator of trademarks. Of course, the URL should be apple.com.us or apple.tm.us. The historical error was not requiring the US to move to 2LDs for it's com/org/net/gov/mil etc domains. Note this is for corporate entities, none of which exist outside regulatory environments.

KronisLV 10mo ago

Cloudflare: "Oh no, we can't have that much centralization, that's horrible, just think of the impact outages have!" Let's Encrypt: crickets Obviously I use LE myself and like what they do, and even in the example above some downtime would have less of an impact than Cloudflare would (due to renewals being less time sensitive), I'm just surprised that there aren't like 5 other orgs that do the same at scale, like an EU based one for example. If there's a lot of domain registrars, why doesn't every single one of them have ACME compatible services? I think there was ZeroSSL but I vaguely remember something scummy about upsells there a few years back.

iso1631 10mo ago
If LE goes down for a week you can't deploy new certs, but your existing ones will work, as you renew them a few weeks before expiry anyway That also gives you enough time to change to get your certs from elsewhere As you mention zerossl exista, and I think google GCM will give you free certs too. Globalsign has an ACME interface for paying customers, although I'm told it has issues (you have to rotate keys manually every X days / N certificates)
- DaSHacka 10mo ago
  > If LE goes down for a week you can't deploy new certs, but your existing ones will work, as you renew them a few weeks before expiry anyway Assuming certificate expiration times remain over 7 days per certificate.
  - iso1631 10mo ago
    There's no (current) plans to drop below 45 day certificates with an expected renewal with 2 weeks to go. I agree if cert lifetimes drop towards week long then it becomes problematic. A sensible thing at that point is to ensure you can issue certificates from different CAs on different underlying stacks, in the same way you use multiple DNS servers

martinclayton 10mo ago

Seems Let's Encrypt also have control of https://letsdecrypt.org https://letsdecrypt.org. It takes you to https://www.nsa.gov https://www.nsa.gov rather than Let's Encrypt. Not sure what to make of that!

fluoridation 10mo ago
letsdecrypt.org doesn't load for me.
- cess11 10mo ago
  Here's a curl from my connection: $ curl -v letsdecrypt.org * Host letsdecrypt.org:80 was resolved. * IPv6: (none) * IPv4: 62.116.130.8 * Trying 62.116.130.8:80... * Connected to letsdecrypt.org (62.116.130.8) port 80 * using HTTP/1.x > GET / HTTP/1.1 > Host: letsdecrypt.org > User-Agent: curl/8.14.1 > Accept: */* > * Request completely sent off < HTTP/1.1 301 Moved Permanently < Server: nginx < Date: Wed, 10 Dec 2025 15:20:48 GMT < Content-Type: text/html; charset=UTF-8 < Transfer-Encoding: chunked < Connection: keep-alive < X-Redirector-ID: 14c2d856bcd2de3beae30791793b40ae43db49fc9ea482a825177a36e20108c4 < Location: http://www.nsa.gov/ < IX-Cache-Status: MISS < * Connection #0 to host letsdecrypt.org left intact Seems to be hosted by InterNetX GmbH. Edit: Ah, over HTTPS protocol it doesn't respond. $ curl -v https://letsdecrypt.org * Host letsdecrypt.org:443 was resolved. * IPv6: (none) * IPv4: 62.116.130.8 * Trying 62.116.130.8:443... Web browsers that add it automatically probably get stuck.
zamadatix 10mo ago
http://letsdecrypt.org http://letsdecrypt.org, no encryption on letsdecrypt :).
einsteinx2 10mo ago
Seems like a joke, including the fact it is only acceptable over HTTP.

hgs3 10mo ago

Congratulations to Let’s Encrypt. I do wish there was something akin to them for code signing. OV and EV certificates are out of reach for many indie devs.

chuckreynolds 10mo ago

Seems longer than 10 years ago? But hey... Let's Encrypt absolutely changed the game... TLS and certificates were a huuuuuge PITA and expensive... we only used them when money was moving around online and they were slow most times. It was also a process to add one, update one, etc. I remember not trusting it at first because it was so easy lol. THANK YOU Let's Encrypt... you made us all more sane, saved time, and secured us all up too. Firm handshakes.

ericmcer 10mo ago
Thats what I thought when I read this too, I feel like they have been around forever. Guess a lot has happened in 10 years.

chasd00 10mo ago

I love Let's Encrypt A small VPS + LetsEncrypt + Dokku is a fantastic way to run personal side projects/hustles at minimal cost.

ge96 10mo ago

I remember buying certs from Godaddy then Namecheap then using Let's Encrypt feels like when GitHub offered free private repos

scotty79 10mo ago

I probably downloaded terabytes of data from the internet unnecessarily because https everywhere makes makes it prohibitively complicated to setup local caching proxy. No to mention time lost waiting for downloads to finish. I'll never understand why caching proxy is not a default part of every OS.

xnx 10mo ago

Let's Encrypt is awesome. Is there any other ridiculously overpriced good/service that could be Let's Encrypt'ed today?

1vuio0pswjnm7 10mo ago

https://community.letsencrypt.org/t/revoking-certain-certificates-on-march-4/114864/7 https://community.letsencrypt.org/t/revoking-certain-certifi... https://community.letsencrypt.org/t/2020-02-29-caa-rechecking-bug/114591 https://community.letsencrypt.org/t/2020-02-29-caa-recheckin... https://bugzilla.mozilla.org/show_bug.cgi?id=1619047 https://bugzilla.mozilla.org/show_bug.cgi?id=1619047 https://www.theregister.com/2020/03/03/lets_encrypt_cert_revocation/ https://www.theregister.com/2020/03/03/lets_encrypt_cert_rev...

johndoh42 10mo ago

10 years of solving a problem that didn't exist, and creating a few dozen new ones in the process. Not evening mentioning the massive security risk they pose; Well, I did now.